CVE-2026-14538 Overview
CVE-2026-14538 is an improper authorization vulnerability [CWE-285] in the bigquery-execute-sql tool component of Google mcp-toolbox. The flaw affects versions 0.16.1 through 1.4.0 and allows an authenticated attacker to bypass allowedDatasets validation. The toolbox depends on the BigQuery dry-run API to enforce dataset restrictions. A fail-open logic flaw causes validation to be skipped when the dry-run API returns an empty array for specialized constructs. Attackers can extract structural DDL schemas from explicitly excluded datasets via INFORMATION_SCHEMA and reach downstream federated row data through EXTERNAL_QUERY connections.
Critical Impact
Authenticated attackers bypass dataset allowlists to read schema metadata from restricted BigQuery datasets and pivot to federated row data via EXTERNAL_QUERY.
Affected Products
- Google mcp-toolbox version 0.16.1
- Google mcp-toolbox versions through 1.4.0
- bigquery-execute-sql tool component
Discovery Timeline
- 2026-07-31 - CVE CVE-2026-14538 published to NVD
- 2026-08-06 - Last updated in NVD database
Technical Details for CVE-2026-14538
Vulnerability Analysis
The bigquery-execute-sql tool enforces an allowedDatasets boundary before executing user-supplied SQL. Enforcement is delegated to the BigQuery dry-run API, which returns the datasets referenced by a query. The toolbox treats the response as authoritative and rejects queries touching disallowed datasets.
The fail-open flaw appears when the dry-run response returns an empty array for specialized constructs such as INFORMATION_SCHEMA views and EXTERNAL_QUERY federation calls. Because the referenced dataset list is empty, the allowlist check finds nothing to reject and permits execution. The attacker then runs queries that read metadata from datasets that should be excluded.
Once inside the query surface, an attacker can enumerate table names, column definitions, and constraints from restricted datasets. Using EXTERNAL_QUERY, the same bypass reaches external federated sources such as Cloud SQL, exposing row-level data outside BigQuery.
Root Cause
The root cause is fail-open authorization logic. Empty results from the dry-run API are interpreted as "no restricted datasets touched" instead of "unable to verify." This inverts the safe default for a security boundary.
Attack Vector
The attack requires low-privilege authenticated access to the MCP toolbox. The attacker submits crafted SQL using INFORMATION_SCHEMA selectors or EXTERNAL_QUERY federation to bypass the allowlist. No user interaction is required.
The vulnerability is described in prose only. See the GitHub Pull Request Discussion for technical details on the fix.
Detection Methods for CVE-2026-14538
Indicators of Compromise
- BigQuery audit log entries showing queries against INFORMATION_SCHEMA in datasets configured as excluded in allowedDatasets.
- EXTERNAL_QUERY calls originating from the MCP toolbox service account targeting federated Cloud SQL or Spanner sources not in the allowlist.
- Anomalous volume of schema enumeration queries from the toolbox principal within a short window.
Detection Strategies
- Compare the effective allowedDatasets configuration against datasets appearing in BigQuery jobs_by_project audit logs for the toolbox service account.
- Alert on any query text from the toolbox containing INFORMATION_SCHEMA or EXTERNAL_QUERY when policy prohibits those constructs.
- Correlate MCP tool invocations with downstream BigQuery job IDs to attribute schema access to specific sessions.
Monitoring Recommendations
- Enable BigQuery Data Access audit logs for all projects reachable by the toolbox service account.
- Forward audit logs to a centralized analytics platform and retain query text for retrospective hunts.
- Monitor for new EXTERNAL_QUERY connection creation on projects that host the toolbox.
How to Mitigate CVE-2026-14538
Immediate Actions Required
- Upgrade Google mcp-toolbox to a version later than 1.4.0 that contains the fix referenced in the vendor pull request.
- Restrict the toolbox service account with IAM policies that deny access to sensitive datasets at the BigQuery layer, independent of application-level allowlists.
- Disable or remove EXTERNAL_QUERY connections that are not required for production workflows.
Patch Information
The fix is tracked in the upstream repository. Review the GitHub Pull Request Discussion for the patched validation logic and upgrade to the corresponding release.
Workarounds
- Enforce dataset access with BigQuery IAM and column-level security rather than relying solely on the toolbox allowedDatasets configuration.
- Block INFORMATION_SCHEMA and EXTERNAL_QUERY constructs at a SQL proxy or query gateway in front of the toolbox until a patched version is deployed.
- Rotate credentials for federated connections that may have been exposed during the affected version window.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
